Overview and Architecture
High level Overview
AuthNull intercepts authentication on your privileged access infrastructure and lets you apply policy based access control, MFA and other privileged access controls to it.
AuthNull is organised into products. Use Switch product in the admin console sidebar to move between them:
| Product | What it protects |
|---|---|
| Identity | Directories, users, and Windows sign-in MFA |
| Database | MFA for database access |
| RADIUS | MFA for VPN and network devices |
| PAM | Privileged SSH access to servers |
Architecture
AuthNull plugs into your existing Active Directory and endpoint authentication infrastructure.
- Identity sources - connect Active Directory or EntraID under Identity Sources (in the Identity product), or add and import users directly under Users.
- DC Sensor - for Active Directory, a sensor installed on each Domain Controller asks AuthNull what to do about every authentication and applies the answer.
- Policies - decide, per user, source, destination and protocol, whether an authentication is allowed, denied or requires MFA.
- MFA provider - push approvals are delivered through the provider selected under Settings → MFA Provider: Duo Security or Okta Verify. The AuthNull Authenticator app is coming soon.
- Audit - every decision, and the MFA outcome, is written to the logs: Logs in Identity and RADIUS, Access Logs in PAM.
How does it work - The details
- A user connects to a resource (for example a domain sign-in, a VPN login or a database session).
- The authentication is passed to AuthNull for a decision.
- AuthNull evaluates the matching policy. The result is Allow, Deny or MFA Required.
- If MFA is required, a push request is sent to the user's phone through the active MFA provider. The user approves or denies it.
- The user is signed in (or refused), and the decision and MFA outcome are logged.
note
For Active Directory, the directory's Fallback if Authnull is unreachable setting (Allow or Deny) decides what happens during an outage.